valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Delete win_cmd_rar.yml

Browse Source 
redundant with  ./rules/windows/process_creation/win_data_compressed_with_rar.yml
authorship was updated
This commit is contained in:
yugoslavskiy 2019-11-11 01:58:22 +03:00 committed by GitHub
parent afb17d0e0e
commit 521d9311c7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
rules/windows/process_creation/win_cmd_rar.yml
View File

@ -1,21 +0,0 @@
title: Command-Line Creation of a RAR file
description: Detect compression of data into a RAR file using the rar.exe utility.
status: experimental
author: E.M. Anhaus (orignally from Atomic Blue Detections, Endgame)
date: 2019/10/24
tags:
- attack.exfiltration
- attack.t1002
detection:
selection:
Image:
- '*rar.exe'
CommandLine:
- '* a *'
condition: selection
falsepositives:
- legit creation of a rar file using cmd
level: high
logsource:
category: process_creation
product: windows